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ADVISORY ACTION 
The Office notes the following argument(s): 

(a) The Examiner failed to state wliicli of tine two specifications sine intended in tine 
underlined phrase "the specification". 

(b) Meeting the written description requirement is a necessary but far from sufficient 
condition for Lachman 2 (US Patent Application 2002/0166063 A1 ) to be used as prior 
art against instant application. 

(c) Lachman 1 (US Provisional Application 60/272,71 2) must meet all of the 
requirements of 35 U.S.C 112, first paragraph with respect to the subject matter relied 
upon In making the rejection. 

(d) Lachman 1 must disclose the invention claimed in Lachman 2 in the manner 
provided by the first paragraph of section 112. 

(e) The Examiner failed to even assert that the Invention claimed In Lachman 2 is 
disclosed In Lachman 1 in the manner provided by first paragraph of 1 12. 

1 . Applicant's arguments filed have been fully considered but they are not 
persuasive. 

In response to: 

(a) The Examiner stated the following: 

The provisional application, Lachman I (60/272,712), for which Lachman III (US 
Patent Application Publication 2002/0166063 A1) claims benefit, discloses subject 
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matter which is described in the specification in such a way as to reasonably convey to 
one skilled in the relevant art that the inventor(s), at the time the application (US Patent 
Publication 2002/0166063 A1) was filed, had possession of the claimed invention. 
Therefore, Lachman III can be used as prior art against the instant application. 
Therefore, the effective date of the patent is the provisional date of March 1 , 2001 . 
"The specification" in the above statement refers back to the provisional application, 
Lachman I (60/272,712). 

(b)-(e) Lachman 2 teaches triggering an "Alert" message (DED message), as well as 
providing attack reports and displaying "Warning" messages (RTP message) 
(paragraphs [0101, 0128, 0153]). 

Lachman 1 teaches this feature of an "Alert" message, as well as providing attack 
reports and displaying "Warning" messages (Specification, page 9, lines 10-11, page 

10, lines 3-7). 

Therefore, both Lachman 1 and Lachman 2 discloses inspecting data packets and 
issuing of a DED message and RTP message. 

Lachman 2 further teaches an offensive countermeasure server/router (RTP) which can 
provide a pathway for initiating an offensive countermeasure against attacker. This 
server/router is connected to the A.N.T. system (DED) (paragraphs [0070-0071]). 
Lachman 1 teaches this feature of a countermeasure router used to initiate a 
countermeasure against attacker. The router is connected to the A.N.T. system (DED) 
(Specification, page 7, lines 6-8, 15-16, 18-20, page 11, lines 11-13). 
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Therefore, both Lachman 1 and Lachman 2 indeed discloses Applicant's DED and RTP. 

Lachman 2 teaches an A.N.T. system that analyzes packets to determine if they match 
a signature of an attack type, or if they contain similar or matching data. The packet 
snifffing module of the system compares information within packets to detect packets 
comprising similar or matching information (paragraphs [0073, 0081, 0098, 0100]). 
Lachman 1 teaches this feature of an A.N.T. system that analyzes packets abd 
determines matching data. The packet sniffing module compares information within 
packets to detect similar or matching information (Specification, page 4, lines 19-23, 
page 5, lines 1-5, 10-13, page 9, lines 10-19, page 11, lines 10-14, 20-23). 
Therefore, both Lachman 2 and Lachman 1 undoubtedly discloses a DED operable to 
search data packets for content match information. 

Lachman 2 teaches the host router can deny or allow certain traffic to the host network. 
Packets that may part of an attack can be rejected from transmission (paragraphs 
[0111,0120]). 

Lachman 1 teaches the feature of the host router denying or allowing certain traffic 

(Specification, page 7, lines 6-8, page 11, lines 3-5). 

Therefore, both Lachman 2 and Lachman 1 discloses preventing further transmission of 
packets. 
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(d)-(e) As shown above, Lachman 1 teaches the features of Lachman 2 as used in the 
rejection of the instant application. Lachman 2 is disclosed in Lachman 1 in the manner 
provided by first paragraph of 112. 

Conclusion 

Any Inquiry concerning this communication or earlier communications from the 
examiner should be directed to BARBARA N. BURGESS whose telephone number is 
(571)272-3996. The examiner can normally be reached on M-F (8:00am-4:00pm). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Arlo Etienne can be reached on (571 ) 272-4001 . The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status Information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated Information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Barbara N Burgess/ 
Examiner, Art Unit 2457 



Barbara N Burgess 

Examiner 

Art Unit 2457 
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January 22, 2009 
/ARIO ETIENNE/ 

Supervisory Patent Examiner, Art Unit 2457 



